diff --git a/rules/windows/process_creation/proc_creation_win_deviceenroller_evasion.yml b/rules/windows/process_creation/proc_creation_win_deviceenroller_evasion.yml
index dbe06719f..1ae85673f 100644
--- a/rules/windows/process_creation/proc_creation_win_deviceenroller_evasion.yml
+++ b/rules/windows/process_creation/proc_creation_win_deviceenroller_evasion.yml
@@ -8,7 +8,7 @@ status: experimental
 author: '@gott_cyber'
 date: 2022/08/29
 tags:
-  - attack.defense.evasion
+  - attack.defense_evasion
   - attack.t1574.002
 logsource:
   category: process_creation